Vulnerability detection method based on source code multi-scale feature extraction and contrastive learning

Abstract

The present invention belongs to the technical field of software vulnerability detection and is a vulnerability detection method based on multi-scale feature extraction and comparative learning of source code. The method comprises the following steps: preprocessing the source code, including standardizing the source code function and extracting the code attribute graph of the source code function; constructing a vulnerability detection model, the vulnerability detection model comprising a code path embedding module, a code graph embedding module, and a classifier; the code path embedding module is used to obtain the local feature vector of the source code function; the code graph embedding module is used to obtain the global feature vector of the source code function; preprocessing the source code to be detected, inputting the preprocessed source code into the vulnerability detection model, and outputting a prediction result of whether the source code function has a defect. The present invention uses a multi-scale source code feature representation method to construct a vulnerability detection model, obtain the local features of the source code, and obtain the global features of the source code. The final embedding vector is derived from the fusion of these two features, which can improve the accuracy of vulnerability detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of software vulnerability detection, and in particular relates to a vulnerability detection method based on source code multi-scale feature extraction and comparative learning. Background Art

[0002] Software vulnerability detection is a core area in cybersecurity, focusing on identifying and remediating security vulnerabilities in software systems. These vulnerabilities can be exploited by malicious attackers, posing a threat to computer system security. With the rapid development of information technology and the widespread use of network applications, software vulnerabilities have become one of the most serious security issues. By exploiting these vulnerabilities, malicious attackers can steal sensitive data, disrupt system functions, or even completely control the victim's computer system. Therefore, timely and effective detection and remediation of these vulnerabilities are critical steps in protecting the security of computer systems and users.

[0003] Static analysis and dynamic analysis are the main methods for traditional software vulnerability detection. Static analysis identifies potential vulnerabilities by examining source code or binary code. This method does not require running the program and can detect problems early in the development phase. However, static analysis can produce a high number of false positives and struggles to detect complex vulnerabilities during dynamic execution.

[0004] Dynamic analysis monitors the behavior of software while it's actually running to identify vulnerabilities. This approach can detect vulnerabilities at runtime, but requires executing the program, which can be computationally expensive and has limited test coverage.

[0005] In recent years, the rise of deep learning (DL) has dramatically transformed the field of software vulnerability detection. Deep learning models can learn from vast amounts of training data, automatically identifying complex patterns and features that may be difficult to detect using traditional methods. The introduction of deep learning has significantly improved the accuracy and granularity of vulnerability detection. Deep learning algorithms, particularly neural networks, can automatically learn potential and abstract vulnerability patterns in code. For example, convolutional neural networks (CNNs) can analyze the structural features of source code, while graph neural networks (GNNs) can capture complex relationships and dependencies within code. Using these technologies, models can identify subtle vulnerabilities, significantly improving the comprehensiveness and accuracy of detection. The application of deep learning algorithms has expanded vulnerability detection beyond traditional pattern matching to include a deeper understanding of code semantics. Models can learn complex vulnerability patterns through code training and automatically detect them. For example, deep learning models can identify unsafe code patterns, potential logical vulnerabilities, and complex vulnerability interactions.

[0006] Existing vulnerability detection methods primarily focus on extracting source code features. Feature representation models that contain rich syntactic information often achieve better vulnerability detection results. Some studies extract graph structures, such as data flow graphs and control flow graphs, from source code and input these structures into graph neural networks (GNNs). However, these methods often overlook the limitations of GNNs and may result in the loss of local semantic features of the source code. Other studies treat source code as natural language and input it into pre-trained models based on the Transformer architecture to enhance detection capabilities. However, these complex models may learn redundant information from the source code and ignore its structural and global features. Summary of the Invention

[0007] To address the technical problems existing in existing technologies, this paper proposes a vulnerability detection method based on multi-scale source code feature extraction and contrastive learning. This method extracts a code property graph (CPG) from the source code, extracts various code paths from the CPG to obtain the source code's embedding vector, and then uses the GraphTrans model to capture the source code's global features. The final embedding vector is derived from the fusion of these two features, allowing the method to simultaneously learn the source code's semantic and structural information, thereby improving vulnerability detection effectiveness.

[0008] The purpose of the present invention can be achieved by taking the following technical solutions:

[0009] The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning includes the following steps

[0010] S1. Preprocess the source code, including standardizing the source code functions and extracting the code attribute graph of the source code functions;

[0011] S2. Build a vulnerability detection model. The vulnerability detection model includes a code path embedding module, a code graph embedding module, and a classifier.

[0012] The code path embedding module is used to extract the code path from the code attribute graph, perform word embedding on the code path through the Doc2vec model, and obtain the local feature vector of the source code function.

[0013] The code graph embedding module is used to embed the code attribute graph through the GraphTrans model to obtain the global feature vector of the source code function;

[0014] The obtained local feature vector and global feature vector are concatenated to obtain a multi-scale feature embedding vector, the multi-scale feature embedding vector is input into the classifier, and the classifier is trained by combining the cross entropy loss function and the supervised contrast loss function to obtain a trained vulnerability detection model;

[0015] S3. Preprocess the source code to be detected, input the preprocessed source code into the vulnerability detection model, and output the prediction result of whether the source code function has defects.

[0016] Specifically, the step S1 includes: standardizing the source code function, and before obtaining the source code graph feature semantic representation, standardizing the variables and function names in the source code function; replacing the variable names in the function with a unified naming format, and replacing the function names with a unified name;

[0017] After standardizing the code, an open source code analysis platform is used to extract the code attribute graph of the source code function.

[0018] Specifically, the method extracts the code path from the code attribute graph, performs word embedding on the code path through the Doc2vec model, and obtains the local feature vector of the source code function, including: extracting the abstract syntax tree path, the control flow graph path, and the program dependency graph path from the code attribute graph; performs word embedding on the abstract syntax tree path, the control flow graph path, and the program dependency graph path respectively through the Doc2vec model, obtains the vector representation of the path, and obtains the local feature vector of the source code function.

[0019] Specifically, the GraphTrans model includes a word embedding model for obtaining source code embedding vectors, a GNN module, and a Transformer module.

[0020] Specifically, the word embedding module is used to extract code sequences from the code property graph CPG, input the sampled code sequences into the word2vec algorithm, and generate vector features of the nodes.

[0021] Specifically, the GNN module adopts a graph isomorphism network GIN to learn the graph embedding representation of CPG and updates it by aggregating the representations of its first-order or higher-order neighbors; represents a graph where , ,node The eigenvector of ,definition Representation node The feature vector at layer i is defined as , the aggregation function of the i-th layer as follows:

[0022] ;

[0023] ;

[0024] in, is a node The set of neighbors and their corresponding edge types, where φ represents the one-hot encoding of the edge type.

[0025] Specifically, the classifier is trained by combining the cross entropy loss function and the supervised contrast loss function to obtain a trained vulnerability detection model, including:

[0026] The loss function SupCE is obtained by combining the cross entropy loss function and the supervised contrast loss function, and the classifier is trained according to the loss function SupCE; the loss function SupCE is expressed as :

[0027] ;

[0028] in, is the weight coefficient that controls the importance between the two loss functions, represents the cross entropy loss function, represents the supervised contrast loss function.

[0029] Specifically, step S3 includes: the classifier of the vulnerability detection model calculates the embedded vector to generate a probability value between 0 and 1; judging whether the source code function has defects through a pre-set probability threshold; when the probability value output by the vulnerability detection model is higher than the set threshold, it is determined that the source code function has a vulnerability or security defect; otherwise, the source code function is determined to be a safe code without vulnerabilities.

[0030] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0031] This paper proposes a vulnerability detection method based on multi-scale feature extraction and contrastive learning from source code. By extracting local features from various source code path representations and using the GraphTrans model to capture global features of the source code, the method obtains a multi-scale feature representation of the source code. This enriches the feature vectors extracted from the source code. The final embedding vector is derived from the fusion of these two features, allowing the semantic and structural information of the source code to be learned simultaneously. By combining the supervised contrastive learning loss function with the cross-entropy loss function, a new loss function, SupCE, is derived. This improves the generalization and stability of the vulnerability detection method, enhancing its effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0033] Figure 1 It is a flow chart of the vulnerability detection method based on source code multi-scale feature extraction and contrastive learning of the present invention;

[0034] Figure 2 is a schematic diagram of source code preprocessing in an embodiment of the present invention;

[0035] Figure 3 is a CPG diagram extracted from source code in an embodiment of the present invention;

[0036] Figure 4 Schematic diagram of the architecture of the vulnerability detection model in an embodiment of the present invention;

[0037] Figure 5 Schematic diagram of a network architecture for acquiring source code path embedding in an embodiment of the present invention;

[0038] Figure 6 Schematic diagram of a network architecture for acquiring source code graph embedding in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is obvious that the embodiments described are only some embodiments of the present invention, not all embodiments, and the implementation of the present invention is not limited to these. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0040] Example 1

[0041] like Figure 1 FIG. 1 is a flow chart of a vulnerability detection method based on source code multi-scale feature extraction and contrastive learning. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning of the present invention comprises the following steps:

[0042] S1. Preprocess the source code, including standardizing the source code functions and extracting the code property graph (CPG) of the source code functions.

[0043] Code preprocessing aims to standardize the source code and extract its graph structure representation. This standardization improves the model's generalization capabilities. By obtaining the source code graph representation, the code's abstract syntax and semantic features are obtained.

[0044] Specifically, the standardization of source code functions is to standardize the variables and function names in the source code functions before obtaining the semantic representation of the source code graph features, including the following three parts: removing the code comments; replacing the variable names in the function with a unified naming format, such as: VAR + index, the prefix of VAR represents a custom variable name, and the index is used to distinguish different variable names in the same function; similarly, the function name is also replaced with a unified name, such as: FUN+index. Through the above code standardization, the noise and specificity in the source code can be reduced, the consistency of the extracted features can be enhanced, and the generalization ability of the subsequent model can be improved. Figure 2 As shown in Figure 2, it is a schematic diagram of source code preprocessing and the source code before and after standardization.

[0045] To extract the code property graph of the source code function, the open source code analysis platform Joern is used to extract the code property graph (CPG) of the source code function after standardizing the code. CPG is a joint code representation method that combines the three code representations of abstract syntax tree (AST), control flow graph (CFG), and program dependency graph (PDG), where PDG is composed of data dependency graph DDG and control dependency graph CDG. AST is an ordered tree representation structure of the source code. It is usually an intermediate product of the compiler and interpreter in the code analysis stage. It removes unnecessary details in the source code and retains the grammatical structure and logical relationships of the program. CFG is a graph structure of all code execution paths during program execution, showing the flow relationship between the basic blocks in the program. PDG is a graph structure containing data flow and control flow details in the source code. By obtaining the joint representation of the code property graph CPG and integrating multiple program relationships, the accuracy of code understanding and analysis is improved, preliminary feature extraction of the source code is performed, and the ability of vulnerability detection is further enhanced. Such as Figure 3 As shown, the CPG diagram of source code extraction, the diagram of the code extraction before and after standardization.

[0046] S2. Build a vulnerability detection model. The vulnerability detection model includes a code path embedding module, a code graph embedding module, and a classifier.

[0047] like Figure 4Figure 1 shows the architecture of the vulnerability detection model. The input of the vulnerability detection model is the source code function. Before inputting the source code into the vulnerability detection model, the source code needs to be preprocessed to extract the CPG graph of the source code function. The code path is extracted from the code property graph (CPG), and then the extracted path in the CFG graph is embedded using Doc2vec to obtain the local feature vector of the source code function. The graph embedding model GraphTrans is used for embedding to obtain the global embedding feature vector of the source code function. The obtained local feature vector and global feature vector are concatenated and input into the classifier. During training, GraphTrans and the classifier are trained simultaneously, and the loss function during training is the SupCE loss function.

[0048] The code path embedding module is used to extract the code path from the code property graph (CPG), perform word embedding on the code path through the Doc2vec model, and obtain the local feature vector of the source code function.

[0049] The process for extracting code paths from the code property graph is as follows: Abstract syntax tree (AST) paths, control flow graph (CFG) paths, and program dependency graph (PDG) paths are extracted from the CPG. AST paths are a set of multiple paths extracted from the AST. Each path starts at a terminal node and ends at another terminal node, with intermediate nodes being non-terminal nodes. To record the order within a path, any two adjacent nodes are connected by {↑,↓} to represent parent-child relationships. Each AST path captures the structure of a source code snippet, and terminal nodes are used to distinguish identical paths appearing in different contexts. CFG paths are multiple paths extracted from the CFG graph. Similar to AST paths, the starting node is a terminal node and the intermediate nodes are non-terminal nodes. Each path represents a possible control flow model during program execution. Three types of paths are extracted: a path that ignores loops and enters the next node; a path that only traverses a loop once to enter the next node; and a path that only traverses a loop once and ends at the loop's start node. Therefore, the end nodes are two types of terminal nodes and the loop's start node. Together, these three paths represent possible execution paths within a loop. PDG paths are multiple paths extracted from the PDG graph structure. Unlike AST, which is a tree structure, PDG is a graph structure. The starting node of a path is a terminal node, and the intermediate nodes are non-terminal nodes. Since PDG is composed of CDG and DDG, each path needs to specify the PDG type.

[0050] like Figure 5As shown in the figure, a schematic diagram of the network architecture for obtaining source code path embedding is shown. The abstract syntax tree (AST) path, control flow graph (CFG) path, and program dependency graph (PDG) path are extracted from the CPG, and Doc2vec is used to embed these code paths. Since the length of the path extracted from each function is different, the Doc2vec model is used to embed the path, and the three paths are connected together to obtain the vector representation of the path, that is, the local feature vector of the source code function is obtained. The Doc2vec model is an unsupervised training strategy that can learn fixed-length feature representations from variable-length text, overcoming the limitations of the bag-of-words method. In addition, it can also use functions from other projects to build a training corpus to address the problem of insufficient number of functions in the project.

[0051] The code graph embedding module is used to embed the code attribute graph through the GraphTrans model to obtain the global feature vector of the source code function.

[0052] Compared with the code graph structure representation which contains rich grammatical and semantic information, the embedding vector extracted from the code path inevitably loses some grammatical and semantic information. To address this problem, the CPG graph is directly embedded to capture the global information of the source code to compensate for the loss of overall structural information in the code path representation. The general method of graph embedding is to use graph neural networks (GNN), but GNN cannot extract long-distance dependencies in the code graph structure. In view of the successful performance of Transformer in long-distance dependencies, the GraphTrans model will be used for graph embedding. The GraphTrans model consists of three main modules: a word embedding model for obtaining source code embedding vectors, a GNN module, and a Transformer module following the GNN. As Figure 6 As shown in Figure 1, a schematic diagram of the network architecture for obtaining source code graph embedding is shown.

[0053] The word embedding module is used to extract code sequences from the code property graph CPG, input the sampled code sequences into the word2vec algorithm, and generate vector features of the nodes. Since the content of each node in the extracted code property graph CPG is source code, it must be converted into a vector representation before being input into the GraphTrans model. The present invention adopts the Word2vec algorithm for embedding. Word2vec represents words as dense vectors and embeds them into a continuous vector space to capture the semantic similarity and grammatical relationship between words. The input of the Word2vec algorithm is multiple word sequences, so it is necessary to first extract code sequences from the code property graph CPG. In order to retain the adjacency characteristics of the nodes in the code sequence, the random walk method is used to obtain these sequences. This method samples the CPG to ensure that adjacent nodes are likely to be connected in the code sequence. Subsequently, the sampled code sequence is input into the word2vec algorithm to learn the semantic relationship between nodes and generate vector features of the nodes.

[0054] The GNN module, in this embodiment, uses a graph isomorphism network GIN to learn the graph embedding representation of CPG and update it by aggregating the representations of its first-order or higher-order neighbors. represents a graph where , ,node The eigenvector of .definition Representation node The feature vector at layer i is defined as In this invention, a graph isomorphic network GIN is used, so the aggregation function of the i-th layer is as follows:

[0055] ;

[0056] ;

[0057] in, Representation node The Aggregate function is used to collect information from the neighbors.

[0058] Commonly used Aggregate functions include MEAN, SUM, and MAX. This paper selects the SUM function as the aggregation function. The goal of the MLP function is to integrate information from neighbors into the node representation. Considering that the GIN graph isomorphic network is designed for isomorphic graphs, this paper improves the message passing method in the GIN graph isomorphic network. When obtaining neighbor features, in addition to considering the characteristics of neighbor nodes, it is also necessary to consider the edge type in the CFG graph, such as AST, CFG, DDG, and CDG. Therefore, the above aggregation function can be improved as follows:

[0059]

[0060] in, is a node The set of neighbors and their corresponding edge types, where φ represents the one-hot encoding of the edge type. The encoding result is then input into the MLP to obtain Embedding vectors of the same dimension are finally connected with the embedding vectors of edges and nodes. Through the above optimization, GIN can effectively learn the edge information in CPG.

[0061] Transformer module, the present invention will Linearly project to the linear dimension of Transformer and apply layer normalization for normalization.

[0062] ;

[0063] in, is a learnable weight matrix, and Represent the dimensions of Transformer and the output dimensions of GNN respectively, Indicates the GIN network before the Transformer returns the vector representation of the Lth layer and node i. The node embedding after mapping This is then fed into the Transformer layer. Since there's no sequential order between the input nodes, and the embeddings obtained by the GNN already include the positional information between the corresponding nodes, the Transformer's positional information encoding is omitted. Subsequently, the embedding vector is fed into the self-attention network.

[0064] ;

[0065] ;

[0066] ;

[0067] in, are the query matrix, key matrix, and value matrix respectively. Similar to the standard Transformer, the results of the multi-head attention are connected together to form the final The concatenated encoding is then fed into the fully connected (FC) subnetwork of the Transformer. This subnetwork consists of a standard sequence of operations: layer normalization → FC → nonlinear activation → dropout → FC → dropout → layer normalization. Residual connections are applied from the first dropout to And connected from before the first FC sub-layer to the dropout immediately after the second FC sub-layer. In this way, the Transformer module can effectively process the node embedding output by GNN, capture global information and further improve the representation ability.

[0068] The obtained local feature vector and global feature vector are concatenated to obtain a multi-scale feature embedding vector. The multi-scale feature embedding vector is input into the classifier. The classifier is trained by combining the cross entropy loss function and the supervised contrast loss function to obtain a trained vulnerability detection model.

[0069] In this example, a new loss function, SupCE, is derived by combining the cross-entropy loss function with the supervised contrastive loss function (SupCon). This loss function is used to train the classifier. SupCon can fully utilize the information of positive and negative samples in a batch to address the class imbalance problem in the dataset. The following is a detailed introduction to SupCon:

[0070] SupCon can be seen as a generalization of triplet loss and N-pair loss. Triplet loss uses one positive and one negative sample for each anchor point, while N-pair loss uses one positive sample and multiple negative samples. SupCon dynamically adjusts the number of positive and negative samples in each batch. By including more positive and negative samples, SupCon enhances the ability to distinguish between signal and noise. The supervised contrastive loss function (SupCon) is as follows:

[0071]

[0072] in, Represents the index set of all samples in the batch, called anchor points, Represents the set of all sample indices in the batch except index i. represents the set of sample indices in the batch that belong to the same category as anchor point i, and |P(i)| is the cardinality of the set. is a scalar temperature parameter.

[0073] By combining the above two loss functions, the loss function SupCE can be expressed as :

[0074] ;

[0075] ;

[0076] in, is the weight coefficient that controls the importance between the two loss functions, represents the cross entropy loss function, Represents a supervised contrast loss function. The final loss function The formula is as follows:

[0077] ;

[0078] By adjusting The value of can balance the importance of cross entropy loss and supervised batch contrast loss in model training. This combination helps to make full use of the information of positive and negative samples in the dataset when dealing with class imbalance problems.

[0079] Preferably, the value of α in this example is 0.5, balancing the importance of cross-entropy loss and supervised batch contrastive loss in model training. This combination helps fully utilize the information of positive and negative samples in the dataset when dealing with class imbalance. The classifier classifies specific source code based on the embedding vector and outputs a prediction result indicating whether the source code function has a defect.

[0080] S3. Preprocess the source code to be detected, input the preprocessed source code into the vulnerability detection model, and output the prediction result of whether the source code function has defects.

[0081] The source code to be tested is preprocessed, standardized, and its CPG graph is extracted. The source code's embedding vector is obtained and then input into a trained vulnerability detection model. Specifically, the vulnerability detection model's classifier calculates the multi-scale feature embedding vector and generates a probability value between 0 and 1, indicating the likelihood that the function contains a vulnerability. A pre-set probability threshold, such as 0.5, is then used to determine whether the function is flawed. If the probability value output by the vulnerability detection model is higher than the set threshold, the source code function is deemed to contain a vulnerability or security flaw. Otherwise, the source code function is deemed to be secure and vulnerability-free.

[0082] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A vulnerability detection method based on source code multi-scale feature extraction and contrastive learning, characterized by: The following steps are involved: S1. Preprocess the source code, including standardizing the source code functions and extracting the code attribute graph of the source code functions; S2. Build a vulnerability detection model. The vulnerability detection model includes a code path embedding module, a code graph embedding module, and a classifier. The code path embedding module is used to extract the code path from the code attribute graph, perform word embedding on the code path through the Doc2vec model, and obtain the local feature vector of the source code function; The code graph embedding module is used to embed the code attribute graph through the GraphTrans model to obtain the global feature vector of the source code function; The GraphTrans model includes a word embedding model for obtaining source code embedding vectors, a GNN module, and a Transformer module; The GNN module adopts the graph isomorphism network GIN to learn the graph embedding representation of CPG and updates it by aggregating the representations of its first-order or higher-order neighbors; represents a graph where , ,node The eigenvector of ,definition Representation node The feature vector at layer l, and define , the aggregation function of the lth layer as follows: ； ； in, is a node The set of neighbors and their corresponding edge types, where φ represents the one-hot encoding of the edge type; The obtained local feature vector and global feature vector are concatenated to obtain a multi-scale feature embedding vector. The multi-scale feature embedding vector is input into the classifier. The classifier is trained using the cross entropy loss function and the supervised contrast loss function to obtain a trained vulnerability detection model. S3. Preprocess the source code to be detected, input the preprocessed source code into the vulnerability detection model, and output the prediction result of whether the source code function has defects.

2. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 1 is characterized in that: The step S1 includes: standardizing the source code function, standardizing the variables and function names in the source code function before obtaining the source code graph feature semantic representation; replacing the variable names in the function with a unified naming format, and replacing the function names with a unified name; after standardizing the code, using an open source code analysis platform to extract the code attribute graph of the source code function.

3. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 1 is characterized in that: The method extracts the code path from the code attribute graph, performs word embedding on the code path through the Doc2vec model, and obtains the local feature vector of the source code function, including: extracting the abstract syntax tree path, the control flow graph path, and the program dependency graph path from the code attribute graph; and performs word embedding on the abstract syntax tree path, the control flow graph path, and the program dependency graph path respectively through the Doc2vec model to obtain the vector representation of the path, thereby obtaining the local feature vector of the source code function.

4. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 1 is characterized in that: The word embedding model is used to extract code sequences from the code property graph CPG, input the sampled code sequences into the word2vec algorithm, and generate vector features of the nodes.

5. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 1 is characterized in that: The cross entropy loss function and the supervised contrast loss function are combined to train the classifier to obtain a trained vulnerability detection model, including: The loss function SupCE is obtained by combining the cross entropy loss function and the supervised contrast loss function, and the classifier is trained according to the loss function SupCE; the loss function SupCE is expressed as : ； in, is the weight coefficient that controls the importance between the two loss functions, represents the cross entropy loss function, represents the supervised contrast loss function.

6. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 5 is characterized in that: The weight coefficient The value of is 0.

5.

7. The vulnerability detection method based on source code multi-scale feature extraction and contrastive learning according to claim 5 is characterized in that: Step S3 includes: the classifier of the vulnerability detection model calculates the multi-scale feature embedding vector to generate a probability value between 0 and 1; judging whether the source code function has a defect based on a pre-set probability threshold; when the probability value output by the vulnerability detection model is higher than the set threshold, it is determined that the source code function has a vulnerability or security defect; otherwise, the source code function is determined to be a safe code without vulnerabilities.

Images